wpForo Forum CVE-2026-5097

The wpForo Forum plugin must be installed and active on a WordPress site at version 2.4.17 or earlier. The 'referer' parameter must reach the SQL query construction logic within the plugin's revisions module or helper functions - meaning page requests that trigger those code paths must be reachable. No authentication is required (PR:N) and no user interaction is needed. Exploitation is constrained to read-only database access; the CVSS vector explicitly shows no integrity (I:N) or availability (A:N) impact, so data modification or service disruption is not possible via this flaw alone. There is no indication that any non-default plugin configuration is required to expose the vulnerability.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, score 7.5) signals a high-priority concern: network-reachable, unauthenticated, low-complexity exploitation with high confidentiality impact. The absence of integrity and availability impact somewhat bounds the blast radius - this flaw enables data theft, not data destruction or service disruption. No EPSS data was supplied, and the vulnerability is not in CISA KEV, so widespread active exploitation has not been confirmed by external intelligence at time of analysis. That said, SQL injection against unauthenticated, low-complexity endpoints in popular WordPress plugins historically attracts automated scanners within days of disclosure; the low exploitation bar warrants treating this as a real priority for any site with the plugin installed. There is no signal conflict between CVSS and description - both consistently indicate unauthenticated network exploitation leading to full database read access.

An unauthenticated attacker sends a crafted HTTP GET or POST request to a WordPress site running wpForo Forum ≤2.4.17, embedding a SQL injection payload in the 'referer' header or parameter targeting a page that invokes the vulnerable revisions code path. The plugin passes the unsanitized value into an existing SQL query, allowing the attacker to append a UNION SELECT or conduct boolean-blind enumeration to extract WordPress users, hashed passwords, private posts, and any other database content. No public POC has been identified, but the unauthenticated network vector means automated vulnerability scanners can trivially detect and attempt exploitation.